topic Re: SSL decryption issue with PIP in General Topics

SSL decryption issue with PIP

Stevenjwilliams83 — Fri, 01 May 2020 00:45:50 GMT

I have added the URL to the exception list with no luck. Any suggestions?

C:\Users\Steven Williams\AppData\Local\Programs\Python\Python38>pip install Flask-SQLAlchemy
WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/
WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/
WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/
WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))': /simple/flask-sqlalchemy/
Could not fetch URL https://pypi.org/simple/flask-sqlalchemy/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/flask-sqlalchemy/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))) - skipping
ERROR: Could not find a version that satisfies the requirement Flask-SQLAlchemy (from versions: none)
ERROR: No matching distribution found for Flask-SQLAlchemy
Could not fetch URL https://pypi.org/simple/pip/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/pip/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)'))) - skipping

C:\Users\Steven Williams\AppData\Local\Programs\Python\Python38>

Re: SSL decryption issue with PIP

JoergSchuetter — Fri, 01 May 2020 07:34:33 GMT

Hello @Stevenjwilliams83

Can you verify the issue is caused by the decryption with browsing the URL https://pypi.org/ in your browser and check the certificate. It could also be, that the firewall does not grant the access, and presents an error page (which is signed with your own certificate, hence the ssl error).

Re: SSL decryption issue with PIP

Stevenjwilliams83 — Fri, 01 May 2020 13:35:55 GMT

I can browse to the site fine. The firewall allows it because I can do it when no SSL decrypt policy is enabled.

What am I looking for in the cert to see what the issue is?

Re: SSL decryption issue with PIP

Stevenjwilliams83 — Fri, 01 May 2020 14:17:08 GMT

Looks like this may be the issue:

https://community.sophos.com/products/xg-firewall/sfos-eap/sfos-v18-early-access-program/f/feedback-and-issues/117248/ssl-tls-inspection-breaks-python-pip

Seems pypi uses their own certs and not operating system certs. Also sees adding that URL is not the end all be all. I will have to probably do some wiresharking to figure all the sites out.

Re: SSL decryption issue with PIP

Stevenjwilliams83 — Fri, 01 May 2020 15:03:31 GMT

Still no dice on this one. I am not sure what the issue is really.

Re: SSL decryption issue with PIP

AnaisRomero — Wed, 13 Apr 2022 15:33:47 GMT

Hi everyone,

I also have this issue with Prisma Access, I do an exception and it works, but does anyone know if this is expected?

Re: SSL decryption issue with PIP

mlinsemier — Wed, 13 Apr 2022 22:25:23 GMT

I would add DNSSniffer from Nirsoft to your toolbox as it has helped me out in countless occasions find troublesome FQDN's not obvious. Not foolproof but works really well when dealing with inclusions/exclusions of FQDNs.